Reproducible builds

[IzzySoft]

At IzzyOnDroid we support Reproducible Builds (see: Reproducible Builds, special client support and more at IzzyOnDroid). Trying for yours, I was able to successfully generate the APK using ./gradlew assembleRelease, but the resulting APKs were not identical: all the assets/public/_nuxt/*.js use completely different file names, for example. Digging into that, I found:

• audiobookshelf-app depends on @nuxt/axios (5.13.6, which is the latest one), which in turn
• … depends on @nuxtjs/proxy (2.1.0, which again is the latest one), which then
• … depends on nuxt: 2.14.11 – a quite outdated version (they are at 3.x already), which produces non-deterministic output, see e.g.
  • appManifest causing non-deterministic build nuxt/nuxt#24940
  • Reproducible or Deterministic Builds with Nuxt Content nuxt/content#2646

Now there is no newer release of Axios. So before digging into the other differences: do you see a chance to fix this, e.g. with some replacement for Axios? If so, the other differences are in classes.dex plus in a bunch of HTML files (which use those Nuxt assets and thus are an "iterative issue" most likely solved alongside the Axios one), plus some *.txt files in public/fonts/*/ (Windows line-breaks; this one can easily be fixed on our end).

The underlying issue at Nuxt is supposed to be fixed – just the "dependency tree" here enforces an old version which is not yet fixed.